diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml index 40751e7..3871b07 100644 --- a/.gitea/workflows/deploy.yml +++ b/.gitea/workflows/deploy.yml @@ -1,4 +1,4 @@ -name: Deploy to Humanitec v2 +name: Deploy to Orchestrator on: workflow_run: @@ -12,104 +12,175 @@ on: required: true default: 'dev' type: choice - options: [dev, staging, production] + options: + - dev + - staging + - prod env: - HUMANITEC_ORG: skillful-wild-chicken-2617 - HUMANITEC_AUTH_TOKEN: ${{ secrets.HUMANITEC_TOKEN }} + PO_API_URL: https://api.dev.orchestrator.crucible.kyndemo.live + PO_ORG_ID: crucible + PO_AUTH_TOKEN: ${{ secrets.PO_AUTH_TOKEN }} + # ONE ORCHESTRATOR PROJECT PER APPLICATION. + # + # This used to be the shared `apps-cluster` project with one environment per app, which + # made every app a peer of every other: the Orchestrator tab on any component listed the + # entire estate, and an app had exactly one environment named after itself, so there was + # nowhere for dev/staging/prod to live. + # + # That shape existed to avoid a Terraform pull request against config/projects.tf for every + # scaffolded app. That constraint turned out not to be real -- `octl create project`, + # `octl create runner-rule` and `octl create environment` are all runtime operations, so + # the workflow below builds the whole thing on first deploy and needs no repository change. PROJECT_ID: pclinic-andrej-demo1 - DEFAULT_ENV_ID: dev - ACR_REGISTRY: bstagecjotdevacr.azurecr.io + # The runner a project's workloads execute on. This is NOT cosmetic: the Kubernetes and + # Helm providers are ambient, so a workload lands in whichever cluster its runner lives in, + # and Terraform state is keyed per runner. A project bound to the wrong runner deploys to + # the wrong cluster, and repointing it afterwards orphans the state it already owns. + PO_RUNNER_ID: crucible-orchestrator-dev-apps-dev-runner + OCTL_VERSION: 1.0.0 + IMAGE: bstagecjotdevacr.azurecr.io/pclinic-andrej-demo1 jobs: - deploy: - name: Deploy to Humanitec v2 + guard: + name: Platform guard runs-on: ubuntu-latest - if: github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' + outputs: + ready: ${{ steps.check.outputs.ready }} steps: - uses: actions/checkout@v4 - - name: Install dependencies - run: apt-get update -qq && apt-get install -y jq - - name: Install hctl CLI + - name: Check platform initialized + id: check run: | - HCTL_VERSION=$(curl -s https://api.github.com/repos/humanitec/hctl/releases/latest | jq -r '.tag_name') - mkdir -p /tmp/hctl-install - curl -sLo /tmp/hctl-install/hctl.tar.gz "https://github.com/humanitec/hctl/releases/download/${HCTL_VERSION}/hctl_${HCTL_VERSION#v}_linux_amd64.tar.gz" - tar -xzf /tmp/hctl-install/hctl.tar.gz -C /tmp/hctl-install - install -m 755 /tmp/hctl-install/hctl /usr/local/bin/hctl - - name: Ensure Humanitec project and environment exist - env: - HUMANITEC_AUTH_TOKEN: ${{ secrets.HUMANITEC_TOKEN }} - run: | - DISPATCH_ENV="${{ github.event.inputs.environment }}" - ENV_ID="${DISPATCH_ENV:-$DEFAULT_ENV_ID}" - # Create project if it doesn't exist (hctl exits 0 if already exists) - hctl create project "$PROJECT_ID" --set display_name="pclinic-andrej-demo1" 2>&1 | grep -v "already exists" || true - # Create environment if it doesn't exist - hctl create environment "$PROJECT_ID" "$ENV_ID" --set env_type_id=development --set display_name="Development" 2>&1 | grep -v "already exists" || true - echo "✓ Project $PROJECT_ID / env $ENV_ID ready" - - name: Deploy with Score - env: - HUMANITEC_AUTH_TOKEN: ${{ secrets.HUMANITEC_TOKEN }} - run: | - DISPATCH_ENV="${{ github.event.inputs.environment }}" - ENV_ID="${DISPATCH_ENV:-$DEFAULT_ENV_ID}" - DEFAULT_IMAGE="$ACR_REGISTRY/pclinic-andrej-demo1:latest" - # Pre-flight: wait for any deployment from a prior run to finish before calling hctl. - # hctl refuses to start a new deployment while one is still executing. - echo "Pre-flight: checking for in-progress deployments..." - MAX_PREFLIGHT=420 - PREFLIGHT_WAITED=0 - while [ $PREFLIGHT_WAITED -lt $MAX_PREFLIGHT ]; do - PREFLIGHT_STATUS=$(curl -sf -H "Authorization: Bearer $HUMANITEC_AUTH_TOKEN" "https://api.humanitec.dev/orgs/$HUMANITEC_ORG/last-deployments?env_id=$ENV_ID&project_id=$PROJECT_ID&state_change_only=true" | jq -r '.items[0].status // "none"' 2>/dev/null || echo "none") - if [ "$PREFLIGHT_STATUS" != "in progress" ] && [ "$PREFLIGHT_STATUS" != "pending" ] && [ "$PREFLIGHT_STATUS" != "executing" ]; then - echo "Pre-flight passed (status=$PREFLIGHT_STATUS). Proceeding." - break - fi - echo " Prior deployment still running ($PREFLIGHT_WAITED s elapsed, status=$PREFLIGHT_STATUS)..." - sleep 15 - PREFLIGHT_WAITED=$((PREFLIGHT_WAITED + 15)) - done - # First deploy — provisions all resources. On a brand-new Humanitec project the - # dns-k8s-ingress Terraform module runs before the K8s Service exists, so the - # ingress backend port falls back to 3000. A second deploy (below) corrects it - # once the Service is up, which is essential for Java/Python apps on port 8080. - HCTL_EXIT=0 - timeout 300 hctl score deploy "$PROJECT_ID" "$ENV_ID" score.yaml --no-prompt --default-image "$DEFAULT_IMAGE" || HCTL_EXIT=$? - if [ "$HCTL_EXIT" -eq 0 ]; then - echo "✓ First deployment complete for pclinic-andrej-demo1 to $ENV_ID" - elif [ "$HCTL_EXIT" -eq 124 ]; then - echo "✓ First deployment submitted (polling timed out — waiting for K8s to settle)" + if [ -f ".platform/initialized.md" ]; then + echo "ready=true" >> $GITHUB_OUTPUT else - echo "✗ hctl failed with exit code $HCTL_EXIT" - exit $HCTL_EXIT + echo "ready=false" >> $GITHUB_OUTPUT + echo "Skipping: .platform/initialized.md not found" fi - # Poll Humanitec API until the first deployment is no longer in-progress before - # re-deploying. A flat sleep is unreliable — Terraform DNS modules can take 4-6 min. - echo "Waiting for first deployment to finish (polling Humanitec API)..." - MAX_WAIT=360 - WAITED=0 - while [ $WAITED -lt $MAX_WAIT ]; do - DEPLOY_STATUS=$(curl -sf -H "Authorization: Bearer $HUMANITEC_AUTH_TOKEN" "https://api.humanitec.dev/orgs/$HUMANITEC_ORG/last-deployments?env_id=$ENV_ID&project_id=$PROJECT_ID&state_change_only=true" | jq -r '.items[0].status // "unknown"' 2>/dev/null || echo "unknown") - if [ "$DEPLOY_STATUS" != "in progress" ] && [ "$DEPLOY_STATUS" != "pending" ] && [ "$DEPLOY_STATUS" != "executing" ]; then - echo "First deployment finished with status: $DEPLOY_STATUS" - break - fi - echo " Still running ($WAITED s elapsed, status=$DEPLOY_STATUS)..." - sleep 15 - WAITED=$((WAITED + 15)) - done - if [ $WAITED -ge $MAX_WAIT ]; then - echo "Warning: first deployment still running after $MAX_WAIT s — proceeding anyway" - fi - # Second deploy — dns module now reads the real K8s Service port, fixing the ingress - HCTL_EXIT2=0 - timeout 120 hctl score deploy "$PROJECT_ID" "$ENV_ID" score.yaml --no-prompt --default-image "$DEFAULT_IMAGE" || HCTL_EXIT2=$? - if [ "$HCTL_EXIT2" -eq 0 ]; then - echo "✓ Deployment finalised for pclinic-andrej-demo1 to $ENV_ID" - elif [ "$HCTL_EXIT2" -eq 124 ]; then - echo "✓ Second deployment submitted for pclinic-andrej-demo1 to $ENV_ID (polling timed out)" + + deploy: + name: Deploy to Orchestrator + needs: guard + if: >- + (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success' && needs.guard.outputs.ready == 'true') || + (github.event_name == 'workflow_dispatch') + runs-on: ubuntu-latest + steps: + - name: Checkout code + uses: actions/checkout@v4 + + - name: Install octl + run: | + set -euo pipefail + curl -fsSLo /tmp/octl.tar.gz \ + "https://github.com/stellwerk-labs/platform-orchestrator-cli/releases/download/v${OCTL_VERSION}/platform-orchestrator-cli_${OCTL_VERSION}_linux_amd64.tar.gz" + tar xzf /tmp/octl.tar.gz -C /tmp + install -m 755 /tmp/octl /usr/local/bin/octl + octl --version + + - name: Derive environment + run: | + # The environment is now a STAGE of this application -- dev, staging, prod -- because + # the project is the application. It used to be the component id, which was the only + # option while every app shared one project and had to be distinguishable inside it. + DISPATCH_ENV="${{ github.event.inputs.environment }}" + if [ -n "$DISPATCH_ENV" ]; then + ENV_ID="$DISPATCH_ENV" else - echo "✗ Second hctl deploy failed with exit code $HCTL_EXIT2" - exit $HCTL_EXIT2 + # On a workflow_run the branch is the triggering run's, not this job's checkout. + BRANCH="${{ github.event.workflow_run.head_branch }}" + BRANCH="${BRANCH:-${GITHUB_REF_NAME}}" + case "$BRANCH" in + staging) ENV_ID=staging ;; + prod|main|master) ENV_ID=prod ;; + *) ENV_ID=dev ;; + esac + echo "Branch '$BRANCH' maps to environment '$ENV_ID'" fi + echo "ENV_ID=$ENV_ID" >> $GITHUB_ENV + echo "Deploying $PROJECT_ID to environment: $ENV_ID" + + - name: Ensure the project and its runner binding exist + run: | + set -euo pipefail + # Created on first deploy rather than by a pull request against config/projects.tf. + # None of this needs a repository change: project, runner rule and environment are + # all runtime objects. + # + # Neither create is idempotent, so both fall through to a read on the second run. + octl create project "$PROJECT_ID" \ + --set display_name='pclinic-andrej-demo1' || \ + octl get project "$PROJECT_ID" + + # The runner rule is what routes this project's deployments to the apps cluster. + # Creating it twice would leave two rules matching the same project, so it is + # created only when absent -- `create` would happily add a duplicate. + if octl get runner-rules -o json 2>/dev/null | grep -q "\"project_id\": *\"$PROJECT_ID\""; then + echo "Runner rule for '$PROJECT_ID' already exists." + else + octl create runner-rule \ + --set project_id="$PROJECT_ID" \ + --set runner_id="$PO_RUNNER_ID" \ + --no-prompt + fi + + - name: Ensure the environment exists + run: | + set -euo pipefail + # Project and environment ids are POSITIONAL; only env_type_id and display_name go + # through --set. `dev` and `stable` are the only environment TYPES that exist, so + # staging rides on the dev type -- the type governs policy, the id governs identity. + case "$ENV_ID" in + prod) ENV_TYPE=stable ;; + *) ENV_TYPE=dev ;; + esac + octl create environment "$PROJECT_ID" "$ENV_ID" \ + --set env_type_id="$ENV_TYPE" \ + --set display_name="$ENV_ID" || \ + octl get environment "$PROJECT_ID" "$ENV_ID" + + - name: Deploy the Score workload + run: | + set -euo pipefail + # `octl score deploy` is ADDITIVE — it adds or updates a workload in the manifest and + # never removes one. That is the opposite of `octl deploy`, where omission is + # deletion. Do not substitute one for the other. + # No --show-logs: octl 1.0.0 has no such flag and exits 1 with `unknown flag` + # BEFORE contacting the orchestrator, so the whole deploy dies on an argument + # typo. Its nearest relatives are --runner-logs-level (default `info`, already + # what we want) and --skip-logs (which suppresses storage). Neither streams the + # runner's logs into this job, so there is nothing to substitute -- the runner + # logs are read from the orchestrator, not from here. + # The tag must be the commit the BUILD built, and it must be the WHOLE sha. + # + # build-push.yml tags with `` -- all 40 characters -- so the + # 7-character `${GITHUB_SHA:0:7}` this used to pass named a tag that has never + # existed in the registry. + # + # And on a workflow_run, GITHUB_SHA is the DEFAULT branch's head, while the build + # that produced the image ran on `dev`. They coincide only while the branches are + # level. `workflow_run.head_sha` is the triggering run's own commit, which is by + # definition the one that was built; `github.sha` covers the workflow_dispatch case, + # where there is no triggering run. + IMAGE_TAG="${{ github.event.workflow_run.head_sha || github.sha }}" + echo "Deploying ${IMAGE}:${IMAGE_TAG}" + + octl score deploy "$PROJECT_ID" "$ENV_ID" score.yaml \ + --default-image "${IMAGE}:${IMAGE_TAG}" \ + --no-prompt + + - name: Deployment summary + if: always() + run: | + # Same commit the deploy step resolved, abbreviated for reading only -- the + # deployed tag is the full sha. + DEPLOYED_SHA="${{ github.event.workflow_run.head_sha || github.sha }}" + SHORT_SHA="${DEPLOYED_SHA:0:7}" + echo "## Deployment Result" >> $GITHUB_STEP_SUMMARY + echo "| Field | Value |" >> $GITHUB_STEP_SUMMARY + echo "|---|---|" >> $GITHUB_STEP_SUMMARY + echo "| Project | \`$PROJECT_ID\` |" >> $GITHUB_STEP_SUMMARY + echo "| Environment | \`$ENV_ID\` |" >> $GITHUB_STEP_SUMMARY + echo "| Commit | \`$SHORT_SHA\` |" >> $GITHUB_STEP_SUMMARY + echo "[View in Orchestrator Console](https://console.dev.orchestrator.crucible.kyndemo.live/orgs/$PO_ORG_ID/projects/$PROJECT_ID/environments/$ENV_ID)" >> $GITHUB_STEP_SUMMARY